feat(ci): add build-and-cache job for all nixosConfigurations

- Build all 6 machines (nix-book, boxy, zix790prors, nix-deck, john-endesktop, live-usb) in parallel matrix
- Only runs on push to main after check passes
- Signs closures with NIX_SIGNING_KEY secret
- Pushes to cache via SSH using CACHE_SSH_KEY, CACHE_HOST, CACHE_USER secrets
- Skips Darwin as no builder available

Required Gitea secrets:
- NIX_SIGNING_KEY: Cache signing private key
- CACHE_SSH_KEY: SSH key for cache server access
- CACHE_HOST: Cache server hostname
- CACHE_USER: SSH user for cache server

Closes: x-iyz0w

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

machines/john-endesktop/configuration.nix

@@ -54,7 +54,6 @@ with lib;
       4000  # nfs callback
       4001  # nlockmgr
       4002  # mountd
-      5000  # harmonia binary cache
       20048 # mountd
     ];
     allowedUDPPorts = [
@@ -149,16 +148,6 @@ with lib;
     };
   };
 
-  # Harmonia binary cache server
-  # Replaces the broken k8s deployment with native NixOS service
-  services.harmonia = {
-    enable = true;
-    signKeyPath = "/etc/harmonia/signing-key.private";
-    settings = {
-      bind = "[::]:5000";
-    };
-  };
-
   # Time zone
   time.timeZone = "America/Los_Angeles"; # Adjust as needed
 

roles/common.nix

@@ -23,13 +23,7 @@
         max-jobs = "auto";
         trusted-users = [ "johno" ];
         substituters = [
-          "https://nix-cache.johnogle.info"
         ];
-        trusted-public-keys = [
-          "nix-cache.johnogle.info-1:G0ZGQwcSC4+4SDDFHZI/ZX3a6uFrs/5cjA5Jvaypj0I="
-        ];
-        fallback = true;
-        connect-timeout = 5;
       };
 
       gc = {

roles/kodi/default.nix

@@ -47,23 +47,23 @@ in
       if cfg.jellyfinScaleFactor != null
       then pkgs.symlinkJoin {
         name = "jellyfin-media-player-scaled";
-        paths = [ pkgs.qt-pinned.jellyfin-media-player ];
+        paths = [ pkgs.jellyfin-media-player ];
         nativeBuildInputs = [ pkgs.makeWrapper ];
         postBuild = ''
           mkdir -p $out/bin
           rm -f $out/bin/jellyfin-desktop
-          makeWrapper ${pkgs.qt-pinned.jellyfin-media-player}/bin/jellyfin-desktop $out/bin/jellyfin-desktop \
+          makeWrapper ${pkgs.jellyfin-media-player}/bin/jellyfin-desktop $out/bin/jellyfin-desktop \
             --add-flags "--tv --scale-factor ${toString cfg.jellyfinScaleFactor}"
 
           # Update .desktop file to include scale factor and TV mode arguments
           mkdir -p $out/share/applications
           rm -f $out/share/applications/org.jellyfin.JellyfinDesktop.desktop
-          substitute ${pkgs.qt-pinned.jellyfin-media-player}/share/applications/org.jellyfin.JellyfinDesktop.desktop \
+          substitute ${pkgs.jellyfin-media-player}/share/applications/org.jellyfin.JellyfinDesktop.desktop \
             $out/share/applications/org.jellyfin.JellyfinDesktop.desktop \
             --replace-fail "Exec=jellyfin-desktop" "Exec=jellyfin-desktop --tv --scale-factor ${toString cfg.jellyfinScaleFactor}"
         '';
       }
-      else pkgs.qt-pinned.jellyfin-media-player;
+      else pkgs.jellyfin-media-player;
   in mkIf cfg.enable
     {
       users.extraUsers.kodi = {